Testing Quantum Devices: Practical Entanglement Verification in Bipartite Optical 

Systems 
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We present a method to test quantum behavior of quantum information processing devices, such 
as quantum memories, teleportation devices, channels and quantum key distribution protocols. The 
test of quantum behavior can be phrased as the verification of effective entanglement. Necessary 
separability criteria are formulated in terms of a matrix of expectation values in conjunction with 
the partial transposition map. Our method is designed to reduce the resources for entanglement 
verification. A particular protocol based on coherent states and homodyne detection is used to 
illustrate the method. A possible test for the quantum nature of memories using two non-orthogonal 
signal states arises naturally. Furthermore, closer inspection of the measurement process in terms of 
the Stokes operators reveals a security threat for quantum key distribution involving phase reference 
beams. 
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I. INTRODUCTION 

Quantum communication protocols can perform tasks 
that are not possible classically such as quantum key dis- 
tribution [H, HJ, teleportation and quantum memory 
[|}|- Additionally, quantum communication can outper- 
form possible classical counterparts, as is the case for 
superdense coding [5|. 

In experimental realizations (see, e.g., Refs. [1, SHI); 
imperfections are inevitable, and the advantage over a 
classical strategy may be lost. For example, a classi- 
cal strategy for a quantum memory performs a quantum 
measurement on the incoming signal, stores the result 
classically, and prepares a quantum state corresponding 
to the stored result as output. For quantum key distri- 
bution (QKD), the classical strategy to compare against 
is an intercept-resend attack. A typical test for quantum 
memories and teleportation devices is to monitor the fi- 
delity of the stored or transmitted quantum states and 
to compare the observed value to the theoretical limit for 
classical strategies 0, d, ■ 

Especially in infinite-dimensional systems, however, 
knowing which fidelities are classically achievable is non- 
trivial. The question is answered for Gaussian distribu- 
tions of coherent input states in Ref. [10], but an answer 
for general input states is still outstanding. Also, from an 
experimental viewpoint, a continuum set of test states, 
such as a Gaussian distribution, is problematic, and a 
test involving only a small number of input states would 
be preferable. 

The test we develop here does not make direct use 
of any figure of merit and has a simple structure: The 



quantum device is tested on a set of non-orthogonal signal 
states, and the corresponding output states are then mea- 
sured in one of a few measurement settings. In some sit- 
uations, for example, in testing QKD devices or quantum 
teleportation setups, there might be two parties, possibly 
at distant locations, one party (Alice) preparing the input 
states, and the other (Bob) performing measurements on 
the output states. In this case, the two parties might 
make use of classical public communication to collect the 
necessary information to evaluate the test. In other sit- 
uations, like testing a quantum memory, the preparation 
and measurement can be performed by one and the same 
party. 

The test procedure can be reformulated using an 
entanglement-based description. In this formulation, an 
alternative description of the state preparation is used 
[111 ], where Alice creates a bipartite, entangled state and 
sends one subsystem to Bob. By performing a suitable 
measurement on her own subsystem, she can effectively 
prepare the desired signal state. In general, before Al- 
ice's and Bob's measurements, we will have an effective 
entangled state shared by the two parties. As far as the 
action of the quantum device and Bob's measurements 
are concerned, both formalisms are equivalent. 

The main test idea is that classical devices, in 
the special meaning introduced above, will always de- 
stroy any entanglement between Alice and Bob in the 
entanglement-based description. Conversely, if entan- 
glement in the underlying state can be shown from the 
measurement data, then the minimal requirement of ac- 
tual quantum behavior of the device relevant to quantum 
communication is demonstrated. Note that the notion of 
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classicality tested here and relevant to the use of the de- 
vices in a quantum communication context differs from 
the notion of classicality often discussed in a quantum 
optical context 
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To use entanglement verification as a first test of a 
protocol has been proposed in the context of quantum 
key distribution [l3|, [t4j ■ The underlying idea has also 
been used to show ultimate limits for specific QKD 
protocols [HI, [III. For other tasks, such as the storage 
of quantum states, translation to an entanglement-based 
picture and verification of quantum correlations may 
provide an easily implementable test. 

We present in this paper a method to verify entan- 
glement especially suitable for bipartite optical systems, 
which is in principle not limited to a particular Hilbcrt 
space dimension or specific choices of measurements. We 
define the bipartite expectation value matrix, which al- 
lows to detect entanglement even if only partial informa- 
tion on the system is available. 

Section |TT] gives the general definitions and proper- 
ties connected to the verification method. Its workings 
are exemplified in Section IIIII on a discrete-continuous 
cryptography protocol with homodyne detection. Fur- 
thermore, the applicability of the verification method to 
quantum memories is discussed. Section IIVI revisits the 
same protocol and takes into account the phase reference 
necessary for the detection process. The resulting de- 
scription in terms of the Stokes operators will serve as 
a second example of the applicability and limitations of 
the entanglement verification method and raise questions 
about the security of quantum key distribution based on 
homodyne detection. We show that the security may be 
compromised by changes in the phase reference inten- 
sity. Section fVl investigates remedies in the form of addi- 
tional measurements. Additional results for the presence 
of channel losses are given in Section IVII We close with 
a conclusion in Section IVlII 



II. GENERAL ENTANGLEMENT 
VERIFICATION METHOD 

In this section we address the problem of entanglement 
verification in the situation, in which the measurements 
performed on a bipartite system are not tomographically 
complete, i.e., the density matrix of the underlying state 
cannot be completely characterized. An attempted de- 
scription in terms of the density matrix will consequently 
involve many undetermined parameters and will quickly 
become impractical for higher dimensions. 

Instead, each set of measurement outcomes defines an 
equivalence class of compatible states and the specifica- 
tion of this equivalence class, say in the form of a matrix, 
holds all accessible information. The size of such a matrix 
description then depends on the number of measurements 
rather than the Hilbert-space dimensions, and can thus 
be substantially smaller than the density matrix. More- 



over, this description enables the determination of en- 
tanglement conditions, by searching the equivalence class 
for separable states. To this end, we utilize the bipartite 
expectation value matrix (EVM) (cf. [13]) as an object 
which contains all measured information on the state. 

In the following, we first present the general construc- 
tion and properties of the EVM and then explain how to 
use it for a separability criterion. 



A. Construction of the Expectation Value Matrix 

Suppose Alice's and Bob's systems are associated with 
Hilbert spaces Ha and Hb, respectively, and the joint 
system is in the state Pab, acting on Ha ®Hb- Fur- 
ther suppose that Alice's and Bob's measurements are 
described by operators A\A k and B'-Bi, respectively, for 

appropriate sets {Ai} and {Bj}. Then the entries of the 
bipartite EVM are defined as 



\x(PAB)]ij,kl = Tr(pABA}A k 



(1) 



A similar construction in terms of creation and an- 
nihilation operators leads to the so-called matrix of 
moments employed by Shchukin et al. to find criteria for 
non-classicality [l8[ and separability [l!| H3] • The latter 
method was extended to finite-dimensional systems in 
Ref. [H|. 

Observation 1: The expectation value matrix defined 
by Eq. ([1]) is Hermitian and positive-semidefinite for all 
physical states pab- 

Proof: The EVM is Hermitian since 

t _ * 

^ij,kl Xkl,ij 

= Tr(p AB Al A\ ® B\ Bj )* 
= Tv{ P AB[A\A k ®B]B^Y 
= Tv{pA B A\A k ®B)B l ) 

— Xij,kl- 

Non-negativity is shown with the following argument: 
Given a physical state pab, the quantity Tt(pabM'M) 
is non-negative for all operators M. Assuming the partic- 
ular bipartite form M = . Ai <X> Bj with the above 

sets {Ai} and {Bi}, we find 

< Tt(pabM^M) 
= J2 4^{pA B A\A k ® B]Bi)c k i 

ij,kl 

= ^2 c h^(PAB)}i 3 ,kl CM, 
ij,kl 

- c*x(pab)c, Vc 



ij,kl 



so x(Pab) is a positive-semidefinite matrix. 



□ 
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Remarkably, the class of expectation value matrices 
contains, by suitable choices of the sets {Ai} and {Bj}, 
the system's density matrix itself as well as the reduced 
density matrices. An EVM can also contain other useful 
quantities, such as the covariance matrix. An explicit 
construction of an EVM which contains pa and a variant 
of the covariance matrix of subsystem B is used in 

Sec. En] 



B. Entanglement Criterion Based on Partial 
Transposition 

Quantum correlations exist in the measurement data 
if the equivalence class of states compatible with the ob- 
served EVM can be shown to contain no separable states. 
We will use the partial transposition to verify this. Due 
to the product structure of separable states [22[, trans- 
position of either subsystem will result in another valid 
physical state. Therefore, if the partial transpose of a 
state a is not positive, a must be entangled [2a |. 

This property translates to the EVM. Since x{pab) > 
for all physical states pab, violation of 



x(Pab) > 



(2) 



is a sufficient condition for pab to be entangled. The 
same holds for the transpose of subsystem B. In fact, a 
positivity requirement on a matrix, such as Eq. ([2]), gives 
rise to a family of inequalities (cf. [19]), since Eq. @ 
holds true if and only if all principle submatrices of 
x(Pab) have non-negative determinants [HI- Negativ- 
ity of any one of these sub-determinants provides a suf- 
ficient entanglement criterion, a non-trivial example of 
which will be given in Sec. IIV1 

To evaluate the EVM on p T AB , we use the invariance 
of the trace under partial transposition of its argument. 
The partial transpose of the state can thus be transferred 
to a transposition of Alice's measurement operators, i.e.: 



x{p T A A B )hM =Tr( P AB[(AlA k y 



B]B{\ 



(3) 



The usefulness of the entanglement criterion depends on 
the connection between the operators A\Ak and their 
transpose. In the examples that we consider, it turns out 
that each transposed operator is merely a scalar multiple 
of one of the original operators, as illustrated in Sec. IIIII 
Partial transposition is only one of many possible op- 
erations to detect entangled states. In fact, any positive 
but not completely positive map may be used as long as 
the adjoint map can act on the measurement operators 
in a meaningful way. 



C. Limited Information 

It may occur in experimental situations that not all 
entries of the EVM can be measured, however carefully 



the sets {A{\ and {Bj} are chosen. Entries which are not 
accessible must be represented by complex-valued free 
parameters. The criterion (Eq. $Z§) can still be evaluated 
in this case by rephrasing it as follows: If it is not possible 
to find a set of free parameters such that 



x(pab) > and 



x(p T a a b) > 0, 



(4) 



Pab must have been entangled. This search through 
all possible parameter sets is efficiently done with 
semidefinite programming [25$ . If it was known which 
parameter sets are compatible with physically valid 
states, the criterion (Eq. with limited informa- 

tion would be as strong as the criterion (Eq. ^) for 
the fully known EVM. This question for physically al- 
lowed parameter sets is, however, unanswered at present. 

It is important to note that the verification scheme is, 
in principle, completely general, since neither the defini- 
tion (Eq. (P)) of the EVM nor the conditions in Eq. g|) 
contain assumptions about the measurements or the di- 
mensionality. 



III. APPLICATION TO A QKD PROTOCOL 
WITH BINARY MODULATION 



One of the strengths of using the EVM-based entangle- 
ment verification method is that high-dimensional states 
can be represented by a low-dimensional matrix, which 
will be of particular advantage in the continuous- variable 
regime. 

We now apply the verification scheme to quantum key 
distribution. When effective entanglement can be veri- 
fied in a particular implementation, the possibility of an 
intercept-resend attack is excluded. 

The example we use to illustrate the entanglement ver- 
ification method is a very simple protocol for quantum 
key distribution [13, HH . Alice generates a random classi- 
cal bit-string which she wishes to share with Bob and use 
to distill secret key. To achieve this, she simply encodes 
each "0" in a coherent state \a) and each "1" in | — a), 
with a real and positive, and sends those signal states 
over a quantum channel to Bob. The notion of security 
arises form the non-orthogonality of the two signal states 
\a) and \ — a). 

In the equivalent entanglement based picture, Alice's 
source prepares bipartite states 

\^) AB = ^=(\0) A \a) B + \l) A \~a) B ). (5) 

A subsequent projective measurement {|0) A (0|, 11)^(11} 
effectively prepares the above signal states. Also, since 
system A remains in the source, Alice has complete 
knowledge of the reduced density matrix p A . 

Under the action of the quantum channel the origi- 
nally pure signal states evolve to mixed ones. We denote 
the resultant states at Bob's site by po if Alice sent a 
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and by p\ if Alice sent a 1. These conditional states are 
fed into a standard homodyne detection setup [27J where 
they interfere with a strong coherent reference beam on 
a balanced beam splitter. The intensity difference of the 
output arms gives access to the field quadratures, de- 
fined as x = (a) + a)/y/2 and p = i(a^ — a)/y/2. We 
assume here that for each incoming signal pi, i G {0, 1}, 
Bob can measure {x)^ (p)^ Var,-(:r) and Varj(p), where 



= Tr(pix) and Vaii(x) = 



(and likewise 



for p) . 

The existence of entanglement for the present quantum 
key distribution protocol has been investigated in [P?! ]. 
We will reproduce the results of this analysis using the 
method outlined above and show the equivalence of both 
approaches (see Appendix |A"|) . 

With the given measurements, the EVM is con- 
structed in a straightforward way by choosing {Ai} = 
{\ip)(Q\, |V>)(1|}, where \ip) is some generic (and irrele- 
vant) qubit state, and {Bj} = {1b,x,p}. Consequently, 
we obtain the 6x6 matrix 



x(pab) = 



\0)(0\®B 
|1)(0|®5 



PAl 



PA I 



|0)(1| ®B 
\\){\\®B 



P A I 



PAl 



with 



B = 



1b x p 
x x 2 xp 
p px p 2 



Note the special property that pa is included in the 
above EVM, so x(pab) indeed contains all information 
obtainable from the protocol. 

We now evaluate the EVM on the partially transposed 
state pW- Taking an example entry and using the afore- 
mentioned invariance of the trace under partial transpo- 
sition, we find 

[x(pI A B )]2,6=Tr(^[|0)<l|®ip]) 



= Tr{p AB [\Q){l\®xpf A ) 
= Tz{p AB [\l){Q\®xp]) 

= [X(PAB)}6,2 



(0) 
is the 



and similarly for the other entries. Hence, x(P/ 
block transposition of x(pab)- 

Another important point is the undetermined entries 
of the EVM mentioned above. Both off-diagonal blocks, 
for example, are completely unknown with the exception 
of their (1,1) entries. Each unknown entry is represented 
by a complex number, so that the EVM is parameterized 
as 



X= 2 



1 (£)o (p)o 
(x) (x 2 ) Q a + | 

(P)o a- 5 (P 2 )o 
1 c* d* 
c* f* g* + i 
d* q* h* 



1 c 

c f g 
d g — i h 

1 (*>i 
(f) x (x 2 ), &+§ 

6-i (P 2 )r 



, (7) 



where s = (— ot\ot), a and b are real parameters and 
{c, . . . , h} are complex. In the above parameterization, 
the commutator [x,p] = il was used to relate the prod- 
ucts xp and px to each other. Knowledge of the expecta- 
tion value of the commutator is crucial for the success of 
the method. An example where this expectation value is 
not known is given in Section HVl 

Evaluating the entanglement criterion is now a matter 
of finding parameter sets {a, b, . . . ,h} such that the 
EVM satisfies the conditions given in Eq. ([4]). The task 
is simple in the sense that there exist efficient alg orithms 
to solve this semidefinite feasibility problem {28., 2^, [3(| • 

Before presenting results of the numerical analysis, we 
comment on entangled states with positive partial trans- 
position (PPT). Since our method is based on the nega- 
tivity of the partial transposition, no such states can be 
detected. The following observation, however, shows that 
the given structure of signal states and measurements on 
system A do not allow the detection of PPT entangled 
states on principle, independent of the method. 

Observation 2: (Compare Lemma 2 in [17j ) Let p be a 
PPT entangled state not detected by the EVM method. 
Then there exists a separable state compatible with the 
same measured data. 

Proof: x{p Ta ) is the block transposition of x(p) an< i 
therefore fits the same experimental data. Then so 
does the sum (x(p Ta ) + x(/°))/ 2 , which is the EVM of 
p = (p TA + p)/2. This state p is invariant under trans- 
position of subsystem A. Theorem 2 in Ref. [3l[ states 
that any state of dimension 2 x N which is invariant 
under transposition of subsystem A is separable. We ar- 
gue in Appendix IB] that this theorem is applicable to the 
inifinitc-dimcnsional state p and therefore, p is separable. 
□ 



A. Numerical Results for the Sufficient Condition 

Results of the numerical evaluation of the semidefinite 
program naturally rely on actually measured values of the 
known entries of the EVM. In the following, we simulate 
these experimental outcomes with a loss and noise model. 
The channel loss is modeled as a scaling factor ^/fj for the 

n , i . i ~\ output , — / ~\ input 

first quadrature moments, i.e., (a;) /i ~~ * VV\ x )o/i > 
and similarly for p. Noise in the channel is assumed not to 
affect the first moments, but to act as a broadening in the 
observed variances. The variances are incorporated in the 
EVM (Eq. ©) by writing (i 2 ) 0/1 = {x) 2 Q jx +Var(£), and 

(p 2 )o/i = (p)o/i + Var(p). Unless otherwise stated, the 
noise is modeled to increase Var(cc) and Var(p) equally 
(cf. [13 )• A corresponding physical setup is a perfect 
channel with an inserted beam splitter, so that losses 
are attributed to the beam splitter's reflectivity. Feed- 
ing a thermal state into the second input port of the 
beam splitter can simulate the channel noise. Conse- 
quently, this noise model always leads to physical expec- 
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tation values and actual experimental results are in good 
agreement with this model [2(|. It should be noted that 
the verification method itself is independent of the choice 
of noise model. 

Due to the particulars of the noise model, each dis- 
tinct set of measurement outcomes is characterized, for 
a fixed loss value, by only two parameters. Namely, the 
input state overlap (— ot\a), as chosen by Alice, and the 
quadrature variance measured by Bob. All parameter 
pairs with < (— a\a) < 1 and Var(x) = Var(p) > 1/2 
are physically valid. 

Figure [T] shows which of these parameter pairs stem 
from entangled states. The plot is shown for T) = 1. 
Corresponding curves for other values of the channel 
transmission have the same characteristic shape, but 
a smaller gradient, cf. Fig. 2 in Ref. (l7j |. We see that 
entangled states are detected as long as the excess noise 
is not too high. The tolerable excess noise decreases for 
smaller input overlaps. Actual experiments can deliver 
values well within this region of entangled states [26| . 

Note that an extension to heterodyne detection would 
allow the measurements of \ <8> xp and ®px, for 
i G {0, 1}. However, although this reduces the number of 
free parameters in the EVM, the results shown in Fig. Q] 
would remain the same for the given channel model. 
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FIG. 1: Input state overlap plotted against measured quadra- 
ture variances for a loss-less channel. Data points in the grey 
shaded area must stem from entangled states. The variance 
broadening induced by the optimal intercept-resend attack is 
indicated by the black dots. 



B. Refining the Method to be Necessary and 
Sufficient 



Whenever the conditions in Eq. ((4| are met, the en- 
tanglement verification method is inconclusive, since the 
numerically-found solution may be unphysical. The ques- 
tion whether a given EVM corresponds to a physical 
state has no straightforward answer. Therefore, we sup- 
plement the method by searching for specific separable 
states compatible with those data sets satisfying Eq. (fj| . 



This search is equivalent to finding specific intercept- 
resend attacks (131] ■ In such an attack, an eavesdropper 
(Eve) measures out the signal states when they leave the 
source and resends appropriately chosen new states ac- 
cording to her measurement outcomes, thus acting as an 
entanglement-breaking channel [Hj]. 

Intuitively, the non-orthogonality of the signal states 
protects against such attacks. When Eve tries to 
distinguish \a) and | — a) and reassign new signals 
accordingly, she inevitably makes errors which will be 
detectable in Bob's observations. In our case, these 
errors will manifest themselves in the form of increased 
uncertainties. Hence, for large measured variances we 
always expect to find an intercept-resend attack, in 
analogy to bit-error rates above 25% in the qubit-based 
BB84 protocol [33[. 

A promising, and ultimately successful, choice of mea- 
surement for the eavesdropper is a minimum-error dis- 
crimination described in Ref. [H]]. For the signal states 
| ± a) , the resulting error probability is given by 



1 1 



e = Wl^ 

2 2 V 



(8) 



Implementations of this minimum error discrimination 
measurement are discussed in Ref. (3o| . 

In other words, if we assume Eve to resend either \ipo) 
or \4>i}: she makes a wrong choice with probability e. 
As a result, Bob's states, conditioned on the original bit- 
values, become 



B.E 



/; ;; - = (l-e)M?)<Vff| 
(l-e)|VTW| 



B.E 

Pi 



e#f>(Vf| 

e\1> E ){i>E\ 



(9) 
(10) 



The exact form now depends on the choice of IV^i)- 

We note here that since the original coherent ampli- 
tudes a have been chosen to be real, the expected vari- 
ance broadening from the attack will only occur in the 
^-direction (cf. Fig. However, Bob expects to observe 
equal variances in x and p, which is achieved by the eaves- 
dropper with appropriate squeezing operations. Hence, 
a natural choice of states is 



(11) 



where D and S are the displacement and squeezing op- 
erators, respectively, and r is a real squeezing parameter 

For each input overlap, the parameters (3 and r can 
now be adjusted to reproduce the values (x) y 1 and (p) /i 
expected by Bob, while inducing the least possible excess 
variance. Denoting the input state overlap by s and the 
channel transmission again by 77, the analytic form of the 
resulting variances in Bob's measurements reads 



Vzr B > E (x) = Var B < £ (p) = ^WT^), 



f 



s 2 In s 

s z — 1 
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FIG. 2: a) Marginal distribution for the input state l^o) = 
|q). b) Bob's conditional state Pq' E after the interaction of 
the eavesdropper. With probability (1 — e), Eve resent \ipo); 
with probability e, she erroneously resent \ipi). 

and is shown in Fig. [1] We see an exact coincidence 
with the entanglement verification curve. This coinci- 
dence holds for all channel loss values. 

The combination of this attack with the entanglement 
verification method is necessary and sufficient to decide 
whether measured data is compatible with a separable 
state or not, for all possible data sets. 



C. Asymmetric Variances 

To assume equal variances for position and momen- 
tum in Bob's observations may be unjustified in some 
situations, but an extension of the above scheme to un- 
balanced excess noise is straightforward. The total mea- 
sured variance will be comprised of input variance and 
excess noise, i.e., 

Var tot (x) = Var m (i) + V ex (x) = I + V ex {x), 

and similarly for p. We find that, even in the case 
V ex {x) ^ V ex (p), the maximum tolerable noise of en- 
tangled states and the minimum variance broadening in- 
duced by an attack (Eq. (1 1 1 [) ) coincide. 



D. Application to Quantum Memories 

We conclude this section with a short discussion on the 
application of the verification method to quantum mem- 
ories. Recently, storage of continuous-variable states of 
light was realized • It was demonstrated that squeez- 
ing of vacuum input states was still observable in the 
output light. 

If any two non-orthogonal input states \4>o/i) are cho- 
sen for testing a quantum memory, we can translate 
the storage process to an entanglement-based picture, in 
complete analogy with Eq. ([5]), with | ± a) B replaced by 
1 0o / 1 ) - Since the entanglement verification method only 
depends on the input-state overlap and the first and sec- 
ond moments of the quadratures of the output light, it is 
applicable to this situation, independent of the particular 
workings of the storage and readout process. 

Verifiable entanglement in this picture is sufficient to 
ensure the quantum nature of the memory. Since this 



strategy requires no tomographically complete measure- 
ments, its experimental realization will require less re- 
sources. 

IV. THE EVM WITH STOKES OPERATORS 

This section examines the protocol more closely by in- 
cluding the so-called local oscillator. This auxiliary light 
beam is used as a reference to define the signal states' 
phase and is necessary for homodyne detection. If the 
local oscillator is in a coherent state of high intensity 
compared to the signal, the detection setup can be used 
to measure the field quadratures, as in the previous sec- 
tion. 

Ideally, the phase reference is prepared locally, but to 
ensure phase stability, it is common practice to split off 
the local oscillator in the signal preparation process and 
send it to Bob over the same quantum channel as the 
signal. The oscillator then inevitably passes through the 
insecure domain controlled by the eavesdropper and we 
cannot make unverified assumptions about its state at 
Bob's site. Consequently, the detection process should 
be regarded as a true two-mode measurement and we 
will employ the Stokes operators to describe it. 

A. Stokes Operators 

Typically, the Stokes operators are used to describe the 
quantum polarization of light using a decomposition into 
two modes of orthogonal polarization (see, e.g., Ref. [3c|). 
In our case, the modes are spatially separated and we 
will label them with subscripts "s" and "LO" to denote 
the signal and the local oscillator, respectively. In this 
language, the input signal states are denoted by 

l^o/l = \OLLO,±OL S ). (12) 

The Stokes operators are defined in terms of mode oper- 
ators as 

Si = a\a s - a\ a L0 
§2 = a\a LO + a' LO a 3 
S3 = i{a\ a s - a\a LO ), 

and the total intensity is often included in the set: 
So = a [ s a s + a\ a L0 . 

Their commutation relations are those of the su(2) alge- 
bra, namely, 

[Si, Sj] = 2ie ljk S k (13) 

for {i,j, k} — {1, 2, 3}, and e^-fc is the Levi-Civita symbol. 
So commutes with the other Stokes operators. As a con- 
sequence of Eq. (|13[) . the minimum uncertainty product 
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of any two Stokes operators depends on the expectation 
value of the third: 



Var(^)Var(^) > |(S fe )| 5 



(14) 



One other property worth mentioning is the operator 
identity 



Si + 1S2 + S3 — Sq + 25q. 



B. Entanglement Verification 



(15) 



The Stokes operators are measured by direct detection 
of intensity differences 39]. If the two incoming light 
modes are spatially separated, the setup is identical 
to that of a homodyne apparatus. Detecting the 
x-quadrature then corresponds to an S2 -measurement 
and the p-quadrature to S3. We therefore assume that 
the two-mode detection process gives access to the 
expectation values and variances of S% and S3. 

An EVM is now constructed in complete analogy to 
the previous section, with {B{\ = {1,52,5*3}, resulting 
in a matrix similar to ([7]). The crucial difference is the 
commutator, which is unknown for this setting since it 
is proportional to the unmeasured quantity (Si). The 
known entries of this EVM are modeled to reflect ac- 
tual experimental data. As before, losses can be modeled 
to downscale the first moments and noise is included as 
broadening of the variances of S2 and S3. 

Numerical results are shown in Fig. [3J again with the 
assumption that the observed variances in S2 and S3 are 
equal. Figure [3] and all following figures are drawn for 
the loss-less case, since channel loss does not qualita- 
tively change the results. An additional figure including 
channel loss can be found in Section [VTl 
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FIG. 3: Signal state overlap plotted against the Stokes opera- 
tor variance for a loss-less channel and local oscillator ampli- 
tude cilo = 100. Only data points above the grey shaded area 
are physically allowed. Solid curve: entanglement verification 
without additional measurements. Dashed line: Intercept- 
resend attack with equal amplitudes in both modes. Dotted 
line: input state variance for reference. 



There are two important points to note: Firstly, unlike 
the quadratures, the variances of the Stokes operators are 
not intensity-independent for coherent state input of the 
form (Eq. (JT2J). Rather, Var(S;) = (S ) holds true for all 
four Stokes operators when evaluated on coherent states 
[38|. Hence, the variances of the input states are also 
plotted. Due to the channel noise, actual measurement 
results are not expected below this coherent state curve. 

Secondly, one can show that data sets below the en- 
tanglement verification curve are in fact unphysical. As 
mentioned above, every valid physical state must lead to 
a positive EVM, which implies that all principle minors of 
x(p) must have non-negative determinants. Taking rows 
and columns (1,2,4) to form a particular submatrix, we 
require 



1 



det 



2/0 
s 



(S 2 2 ) 



>o, 



with s — (—a\a) as before and c denotes a free parameter 
(cf. Eq. Evaluating the determinant leads to 



Var (S 2 ) > 



(S 2 ) s 2 - 2 S (S 2 ) Rc(c) 
1-s 2 



(16) 



Positivity of the sub-determinant (1,4,5) translates to the 
similar condition 

v ari( s 2) > (Ml^M^l±K. (17) 



According to the noise model, (S2) = —(82)1 and 
Var (S 2 ) = Vari(S 2 ) = Var(S 2 ). Adding $Jfy and Q2J 
then gives the final condition 



Var(S 2 ) > 



s 2 (g2) + |c| : 
1-s 2 



(18) 



which is obviously minimized for c = 0. Plotting this 
minimum allowed variance against s exactly coincides 
with the entanglement verification curve shown in Fig. [3J 
Consequently, no entangled states are detected by our 
method in the current measurement setting. 

To refine this last statement, we can again search for 
data pairs compatible with separable states by construct- 
ing a specific intercept-resend attack. The optimal mea- 
surement is the same as before, but the eavesdropper now 
resends 

\i> E ) 0/ i = D LO (P)D s (±P)S s (r)\0) LO \0) s , (19) 

with appropriately chosen parameters. The intuition 
behind this particular choice is that equal coherent 
amplitudes for signal and local oscillator can lead to the 
same first moments of S2 and S3 as the original signals, 
but the total intensity is significantly decreased. This 
equal-amplitude attack can in principle lead to lower 
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variances in Bob's observations than the input states 
would give, and this is indeed the illustrated in 

Fig. [3l In fact, in the limit of high photon numbers, the 
gap between existence curve and attack vanishes. 



C. Implications for Quantum Key Distribution 

Concluding this section, we find that entanglement ver- 
ification is not possible with measurements of the first 
and second moments of S2 and S3 only. Almost all phys- 
ically valid data sets admit an intercept-resend attack 
and are therefore compatible with separable states. No 
secure key can be distilled from such data. 

Since homodyne detection is a standard tool for 
continuous-variable quantum communication, such as 
quantum key distribution with a Gaussian distribution 
of coherent signal states 5l[ , the above attack may 
be a pitfall for a variety of protocols. Care must be taken 
that indeed the field quadratures are measured. Ways to 
ensure this are presented in the following section. 



V. ADDITIONAL MEASUREMENTS 

We consider two additional experimentally feasible 
measurements and investigate their effect on the perfor- 
mance of entanglement detection. 



A. Measuring Si 

A natural choice is the measurement of the third Stokes 
operator Si . Its expectation value and variance are eas- 
ily included in the EVM by choosing the constructing 
set {_B 4 } = {i, Si, £2, S3}) enlarging x(pab) to an 8 x 8 
matrix. It is now also possible to use the commutator 
(Eq. (fl3|) ) of S2 and S3 to relate products of the form 
S2S3 and S3S2 to each other. Since the entanglement 
verification method is otherwise identical to the preced- 
ing sections, we directly present the results in Fig. |4j 

There is a large area above the input state variance for 
which entanglement is ensured. In fact, if the results for 
the quadrature measurements are renormalized by the 
local oscillator intensity, they coincide with the present 
curve. 

There is an intuitive explanation for these results. 
Since (Si) is the difference between the number of pho- 
tons in the signal mode and that in the local oscillator 
mode, measuring (Si) provides a way of verifying that 
the phase reference is indeed much more intense than 
the signal. In this case, we expect to be able to measure 
the quadratures. A conceivably simpler way to achieve 
this verification is to monitor the local oscillator intensity 
separately. 











entanglement verification with Sj 




input state variance 




renormalized quadratures 



0.2 0.4 0.6 0.8 1.0 

input state overlap (-a la ) 

FIG. 4: Signal state overlap plotted against the Stokes opera- 
tor variance for the loss-less case with olo = 100. The renor- 
malized quadrature variances (white circles) coincide with the 
Stokes operator variances when Si is measured. Dashed line: 
input state variance for reference. 



However, these are truly additional measurements in 
the sense that the original setup must be modified. 

Therefore, in Section fVBi we briefly examine the sit- 
uation where, instead of (Si), the total intensity (So) is 
measured. 



B. Measuring the total intensity 

The value of (So) is obtained when the two photocur- 
rents in S2 or S3 detection are added rather than sub- 
tracted. Depending on the experimental particulars, the 
total intensity may be available "for free" with no change 
in the setup necessary (42j . The variance of So is not in- 
cluded in the analysis, since the intensity measurement is 
expected to be much more noisy than the measurements 
of the other Stokes operators. 

Constructing an EVM from {B t } = {i,S ,S 2 ,S 3 } 
gives no advantage over the case when So is not included. 
As far as entanglement detection is concerned, the re- 
sults are identical to those shown in Fig. [3] above. How- 
ever, the powerful equal-amplitude attack (Eq. (fT9| ) is 
not possible in this setting, and a new intercept-resend 
strategy must be constructed. The goal is to show a con- 
ceptual difference from quadrature measurements, i.e., to 
find an attack that explains data sets which would be at- 
tributed to entangled states, if quadrature detection was 
assumed. A corresponding attack can indeed be found. 
Its construction builds on the correspondence between a 
collection of photons in two possible polarization modes 
and an ensemble of spin-half particles aligned along some 
quantization axis. In fact, the Schwinger representation 
of spin operators [43| differs from the above definition of 
the Stokes operators only by factors of 2: Si 2 3 = 2J Z x y . 

For Eve's attack, we use the particular squeezing op- 
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eration 



*70u)=exp(-|(J^-P)), 



called two- axis countertwisting [44 
Her explicit states are given by 



where J± — J x ±iJ y 



Po/i =Pl<i ) X<i } ! + (1 -P^S/iW^l (2°) 



fl(±C,0)J7(M)|j,j) 



(21) 
(22) 



where |j, j) is an angular momentum eigenstate, £ is a 
small rotation angle and n + {n~) arc photon numbers 
larger (smaller) than the total photon number Bob ex- 
pects to measure. Both the rotation operator R(8, 4>) 
[361 ] and the two-axis countertwisting operator conserve 
the total intensity. 

The minimum variance broadening induced by this at- 
tack is plotted in Fig. \5\ together with the entanglement 
verification curve for quadrature measurements. There 
are data sets from separable states well below the latter 
curve, so monitoring (52), (S3), and the total intensity is 
not equivalent to quadrature detection and gives weaker 
results for entanglement verification. However, the at- 
tack was not evaluated for high photon numbers due to 
numerical limitations. 
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FIG. 5: Performance of a 2-axis squeezing attack for 100 pho- 
tons. Dashed line: Entanglement verification with quadrature 
measurements. Solid line: Intercept-resend attack with 2-axis 
twisting for Stokes operator detection and monitoring of the 
total intensity. 

To be able to draw a comparison for more realistic 
intensities, we can replace Eq. (f2"2"| by a quadrature 
squeezed state, i.e. 

IVS/i 3 ) = D LO (&Lo)Ds(±&s)S s (f- + )\0) LO \0) s . 

The need for numerical evaluation is completely removed 
by the further simplification 

= D LO ((3)D s (±f3)S LO Ar-)\0) LO \0) s , 



where Slo.s is the two-mode squeezing operator. Al- 
though both of these simplifying steps deteriorate the 
effectiveness of the attack, they can still account for data 
points below the quadrature entanglement verification 
curve (Fig. [6]) . The resulting gap does increase with the 
total photon number, albeit at a much lower rate. 
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FIG. 6: Different attacks for a total intensity of 10 4 . 
The dashed line results form entanglement verification with 
quadrature detection. Solid line: Attack with a mixture of 
2-axis twisted and quadrature squeezed states for Stokes and 
total intensity measurements. Dotted line: The same attack 
with 2-mode squeezing instead of 2-axis countertwisting. 



Still, a large number of data points is neither explained 
by the intercept-resend attack nor detected by the entan- 
glement verification method. It remains unclear if the 
measurements do not provide enough information on the 
state or if the construction of the EVM is unsuited to 
verify entanglement for this particular scheme. 



VI. ADDITIONAL FIGURE FOR CHANNEL 
LOSS 

This final section concerns the effect of channel loss on 
all of the above results involving the Stokes operators. 
It is easily seen that the first moments of the Stokes op- 
erators scale as the channel transmission 77, just as the 
reference coherent state variance. The existence curve, 
Eq. (fTg)) . however scales as rj 2 and so does the corre- 
sponding intercept-resend attack. Typical results in the 
presence of loss are shown in Fig. [7] for 50 % channel 
transmission, together with the entanglement verification 
including (Si). 



VII. CONCLUSION 

In conclusion, we have constructed bipartite expecta- 
tion value matrices as a description of systems with par- 
tial knowledge. Such matrices were used to formulate 
general sufficient criteria for entanglement, which allow 
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FIG. 7: The above Stokes operator variances for a channel 
which transmits half of the input intensity. 
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APPENDIX A: EQUIVALENT METHODS 



the evaluation of partial transposition for, in principle, 
arbitrary dimensions and measurement operators. 

The EVM method was applied to a communication 
protocol with coherent signal states and homodyne 
detection. With the assistance of an intercept-resend 
strategy, detection of the first and second moments 
of the field quadratures was sufficient to attribute all 
possible measurement outcomes to either separable or 
entangled states. A more complete description of the 
measurements in terms of Stokes operators revealed the 
inaptitude of the protocol to generate secret key. Two 
examples of additional measurements were considered 
to rectify this issue. Monitoring of the local oscillator 
intensity was found to recover the quadrature results. 
Instead, monitoring the total intensity showed data sets 
neither explainable by entanglement verification nor by 
the best known intercept-resend strategy. Thus, this last 
example demonstrated that the success of the presented 
method crucially depends on the choice and structure 
of Bob's measurements. This example also underlined 
the need for a criterion to decide which expectation 
value matrices are physically valid, which would result 
in stronger separability conditions. This question is, 
however, unanswered at present, and subject to future 
research. 



In Ref. [l7|, the constructed entanglement criteria are 
based on uncertainty relations. We will show that this 
approach is equivalent to our method based on partial 
transposition. Rigas et al. fl7| constructed a symmetric 
version of the EVM defined as 



X s (P) 



0) (0| 8B ! 

1) (0| ® B l 



with B s given by 



B s 



p \{xp + px) 
Then the inequalities 



|0)(l|®B f 
|1)(1| <8> B' 



P 

\{xp+px) 



X s (p)±-pa®J>0, 



with 




(Al) 



(A2) 



(A3) 



are satisfied by all separable states, and violation implies 
entanglement. 



Moreover, the presented method is proposed as a sim- 
ple way to test quantum devices, which may be of partic- 
ular interest for the continuous- variable storage of light. 
Two non-orthogonal signal states and detection of the 
first and second moments of the field quadratures of the 
output light suffice to verify the quantum operation of 
the memory, with no need for a complete reconstruction 
of the output density matrix. The particular light-atom 
interactions in the storage process are, as far as entan- 
glement verification is concerned, not relevant. 



These two inequalities turn out to be equivalent to the 
conditions 

X(p) > and x(p Tb ) > (A4) 

for the unsymmetrized EVM. Product entries can be split 
into their symmetrized product and commutator: 

xp = i (xp + px) + i [x , p] (A5) 

= ^(ip + px) + -i, (A6) 



11 



so that x(p) = X s (p) - A/2 PA ® J- 

Since Bob's operators are transposed according to the 
rule x — ► x and p — > — p, we find that 



(A7) 



where 17 = 1a® diag[l, 1,-1] and x(p) is given by (|Alll . 
with P s replaced by 



The vectors {\k) B }^ =1 form a basis for system B. Intu- 
itively, 



\Pab 



^AB II*'' = "W, 

lim (5 



(B3) 
(B4) 



l x p 

x x 2 px 
p xp p 2 



(A8) 



Then \(p) — X s (p) + A/2 pa ® J, i.e. the two conditions 
(|A3[) are, up to a local unitary transformation, equivalent 

to ja. 



where || . . . || tr denotes the trace norm. In other words, 
the sequence {<5/v} is convergent. Therefore, Ve, 3 n € N 

(n) 

such that pab and are closer than e in trace distance. 

Furthermore, cr^L is invariant under transposition of 
system A: 



APPENDIX B: SUPPLEMENTARY PROOF FOR 
OBSERVATION 2 

We show that Theorem 2 in Ref. [3l[ applies to the 
infinite-dimensional case, i.e., to states pab on TIa®7~Lb 
with dim(H.A) = 2 and dim(Ti.B) — oo. That is, we prove 
the statement that if such a state pab is invariant under 
transposition of subsystem A, it is separable. To this 
end, we approximate pab by finite-dimensional states 



(Bl) 



with normalization factor J\f and the projection operator 



P B N) =h k )B( 
fc=l 



(B2) 



ab) 



= ^[(^®Pr ) r>^(l^®pW)^ ] 

= AA[(lA ® P^PABiU ® P^)] 



as by assumption, = pab- Therefore, <r^^ is sepa- 
rable. Consequently, p^s is approximated by a convex 
combination of product states, so pab is separable [22| . 
□ 



(B5) 
(B6) 
(B7) 
(B8) 
(B9) 
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